Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   .. kann ich die gefundene Objekt von Malwarebytes Problemlos löschen? (https://www.trojaner-board.de/131007-gefundene-objekt-malwarebytes-problemlos-loeschen.html)

gismo74 13.02.2013 17:24
.. kann ich die gefundene Objekt von Malwarebytes Problemlos löschen?
 
Hallo ..

Ich habe Malwarebytes im vollständiger dursuchlaul durchlaufen lassen .. es wurden mehrere Sachen gefunden .. wie gehe ich da weiter zu ganga? :confused:
.. kann ich das gefundene einfach so löschen? .. oder bekomme ich dann mir meinem Rechner Probleme? .. Verlust von Daten.Ordner usw.

Ich bedanke mich schon mal im voraus für die hilfe

Gruss gismo74

cosinus 14.02.2013 12:39
Hallo und :hallo:

Zitat:
.. kann ich die gefundene Objekt von Malwarebytes Problemlos löschen?
Wie bittte soll das einer von uns genau beurteilen wenn du die Logs dazu nicht postest?? :glaskugel:
Bitte alle Logs nachreichen, direkt in deinem nächsten Beitrag in CODE-Tags bitte posten!


Bevor wir uns dann an die weitere Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Erstmal eine Kontrolle mit OTL bitte:
  • Doppelklick auf die OTL.exe
  • Vista User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
  • Setze oben mittig den Haken bei Scanne alle Benutzer
  • Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in CODE-Tags in den Thread.

gismo74 15.02.2013 18:14
Hallo ..
Sorry das ich es versäumt habe die Logdateien mit hier rein zu kopieren .. nachträglich kommen hier die Logdateien ..
Ach ja .. die *OTL.exe* finde ich bei mir nicht ..
Ich muss dazu sagen,ich bin nicht ganz fit mit dem PC ..


Code:
Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2012.12.14.11

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
**** :: SN426168555778 [Administrator]

19.01.2013 11:27:16
mbam-log-2013-01-19 (11-27-16).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 313250
Laufzeit: 2 Stunde(n), 52 Minute(n), 35 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 39
HKCR\CLSID\{014DA6C9-189F-421a-88CD-07CFE51CFF10} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{0494D0D0-F8E0-41AD-92A3-14154ECE70AC} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\Interface\{0494D0D4-F8E0-41AD-92A3-14154ECE70AC} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Way Speedbar Uninstall (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\CLSID\{0494D0D1-F8E0-41ad-92A3-14154ECE70AC} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\CLSID\{25642629-2705-43d4-ADDE-68922C0E6BA7} (PUP.FunWebProducts) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{D6C8ACD0-C524-4dd9-87BE-84E6E01FEE63} (PUP.FunWebProducts) -> Keine Aktion durchgeführt.
HKCR\Interface\{25642628-2705-43D4-ADDE-68922C0E6BA7} (PUP.FunWebProducts) -> Keine Aktion durchgeführt.
HKCR\MyWay.PopSwatterSettingsControl.1 (PUP.FunWebProducts) -> Keine Aktion durchgeführt.
HKCR\MyWay.PopSwatterSettingsControl (PUP.FunWebProducts) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\MyWay (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\CLSID\{825E5863-834C-4C9E-861A-5402FB2FA854} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\MyWay.HTMLMenu.1 (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\MyWay.HTMLMenu (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\TypeLib\{A04D524D-D4D6-4230-975F-648F8A658D4F} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\Interface\{39AE719A-B3AE-4711-8143-65CD1F97DC7C} (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
HKCR\CLSID\{014DA6C9-189F-421a-88CD-07CFE51CFF10} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\TypeLib\{0494D0D0-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\Interface\{0494D0D4-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\My Way Speedbar Uninstall (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{0494D0D1-F8E0-41ad-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D1-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\CLSID\{0494D0D9-F8E0-41ad-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{04079851-5845-4DEA-848C-3ECD647AA554} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{04079851-5845-4DEA-848C-3ECD647AA554} (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyWayToolBar.NetscapeShutdown (Adware.MyWaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyWayToolBar.NetscapeShutdown.1 (Adware.MyWaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyWayToolBar.NetscapeStartup (Adware.MyWaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyWayToolBar.NetscapeStartup.1 (Adware.MyWaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyWayToolBar.SettingsPlugin (Adware.MyWaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCR\MyWayToolBar.SettingsPlugin.1 (Adware.MyWaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\MyWay (Adware.MyWaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 4
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser|{0494D0D9-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Daten: ÙДàø*A’£NÎp¬ -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar|{0494D0D9-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{0494D0D9-F8E0-41AD-92A3-14154ECE70AC} (Adware.MywaySearch) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{0494D0D9-F8E0-41ad-92A3-14154ECE70AC} (Adware.MywaySearch) -> Daten:  -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 13
C:\Programme\FunWebProducts (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\FunWebProducts\MyWay (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\FunWebProducts\MyWay\Cache (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\1.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\History (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Settings (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\SrchAstt (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\SrchAstt\1.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\SrchAstt\Cache (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\SrchAstt\Settings (PUP.MyWebSearch) -> Keine Aktion durchgeführt.

Infizierte Dateien: 24
C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\1.bin\MYPOPSWT.DLL (PUP.FunWebProducts) -> Keine Aktion durchgeführt.
C:\Programme\FunWebProducts\MyWay\Cache\CursorManiaBtn.html (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\FunWebProducts\MyWay\Cache\SmileyCentralBtn.html (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\1.bin\MWHTMLMU.DLL (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\1.bin\MYWAYPLUGINPROXY.CLASS (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\1.bin\PARTNER.DAT (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\1.bin\PARTNER2.DAT (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\00020F86 (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\00021B4E.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\00021ED8.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\00022214.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\00022437.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\00022745.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\00022A13.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\00022BD8.bin (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Cache\files.ini (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\History\search (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\Settings\prevcfg.htm (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\SrchAstt\1.bin\PARTNER.DAT (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\SrchAstt\Cache\002B6C55 (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\SrchAstt\Cache\files.ini (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\SrchAstt\Settings\prevcfg.htm (PUP.MyWebSearch) -> Keine Aktion durchgeführt.
C:\Programme\MyWay\myBar\1.bin\MYBAR.DLL (Adware.MywaySearch) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)



Malwarebytes Anti-Malware 1.70.0.1100
www.malwarebytes.org

Datenbank Version: v2013.02.13.07

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
**** :: SN426168555778 [Administrator]

13.02.2013 17:16:35
mbam-log-2013-02-13 (17-16-35).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 321582
Laufzeit: 2 Stunde(n), 28 Minute(n), 6 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 1
C:\Programme\Zylom Games\Gold Rush - Treasure Hunt Deluxe\goldrush2.exe (PUP.Downloader.ZYL) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

cosinus 16.02.2013 15:28
Zitat:
Ach ja .. die *OTL.exe* finde ich bei mir nicht ..
Ist das nicht logisch,dass du dir OTL runterladen musst?! Die Anleitungen sind nicht zur Deko mit Links bestückt :pfeiff:

gismo74 19.02.2013 10:39
Hier das ergebnis von OTK.exe ..

OTL Logfile:
Code:
OTL logfile created on: 19.02.2013 09:10:29 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Dokumente und Einstellungen\*** \Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
894,10 Mb Total Physical Memory | 317,57 Mb Available Physical Memory | 35,52% Memory free
2,10 Gb Paging File | 1,19 Gb Available in Paging File | 56,69% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 32,85 Gb Free Space | 44,08% Space Free | Partition Type: NTFS
 
Computer Name: SN426168555778 | User Name: Sven Völkl | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Dokumente und Einstellungen\Sven Völkl\Eigene Dateien\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Programme\AVG Secure Search\vprot.exe ()
PRC - C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Programme\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
PRC - C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
PRC - C:\Programme\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC)
PRC - C:\Programme\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIGGE.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\APPS\Powercinema\PCMService.exe (CyberLink Corp.)
PRC - C:\WINDOWS\system32\oodag.exe (O&O Software GmbH)
PRC - c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
PRC - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
PRC - c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink)
PRC - C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
PRC - C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe ()
PRC - C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe ()
PRC - C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe (America Online, Inc.)
PRC - C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\14.2.0\SiteSafety.dll ()
MOD - C:\Programme\AVG Secure Search\vprot.exe ()
MOD - C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_149.dll ()
MOD - C:\Programme\Mozilla Firefox\mozjs.dll ()
MOD - C:\Programme\Kaspersky Security Suite CBE 12\qtgui4.dll ()
MOD - C:\Programme\Kaspersky Security Suite CBE 12\qtscript4.dll ()
MOD - C:\Programme\Kaspersky Security Suite CBE 12\qtsql4.dll ()
MOD - C:\Programme\Kaspersky Security Suite CBE 12\qtcore4.dll ()
MOD - C:\Programme\Kaspersky Security Suite CBE 12\qtnetwork4.dll ()
MOD - C:\Programme\Kaspersky Security Suite CBE 12\qtdeclarative4.dll ()
MOD - C:\Programme\Kaspersky Security Suite CBE 12\imageformats\qgif4.dll ()
MOD - C:\Programme\Yahoo!\Messenger\yui.dll ()
MOD - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\pdfshell.DEU ()
MOD - C:\Programme\Google\Google Desktop Search\gzlib.dll ()
MOD - C:\WINDOWS\system32\msdmo.dll ()
MOD - c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
MOD - c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
MOD - c:\APPS\Powercinema\Kernel\TV\CLSchMgr.dll ()
MOD - c:\APPS\Powercinema\Kernel\TV\CLSchedps.dll ()
MOD - c:\APPS\Powercinema\Kernel\TV\CLCapEngine.dll ()
MOD - c:\APPS\Powercinema\Kernel\TV\CLCapSvcps.dll ()
MOD - C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe ()
MOD - C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe ()
MOD - C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorRes_DEU.dll ()
MOD - C:\Programme\ArcSoft\PhotoImpression 5\Share\PIHook.dll ()
 
 
========== Services (SafeList) ==========
 
SRV - (HidServ) -- %SystemRoot%\System32\hidserv.dll File not found
SRV - (AppMgmt) -- %SystemRoot%\System32\appmgmts.dll File not found
SRV - (vToolbarUpdater14.2.0) -- C:\Programme\Gemeinsame Dateien\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe ()
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (McComponentHostService) -- C:\Programme\McAfee Security Scan\3.0.318\McCHSvc.exe (McAfee, Inc.)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (TomTomHOMEService) -- C:\Programme\TomTom HOME 2\TomTomHOMEService.exe (TomTom)
SRV - (AVP) -- C:\Programme\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
SRV - (YahooAUService) -- C:\Programme\Yahoo!\SoftwareUpdate\YahooAUService.exe (Yahoo! Inc.)
SRV - (O&O Defrag) -- C:\WINDOWS\system32\oodag.exe (O&O Software GmbH)
SRV - (CLSched) -- c:\APPS\Powercinema\Kernel\TV\CLSched.exe ()
SRV - (CLCapSvc) -- c:\APPS\Powercinema\Kernel\TV\CLCapSvc.exe ()
SRV - (CyberLink Media Library Service) -- c:\APPS\Powercinema\Kernel\CLML_NTService\CLMLServer.exe (Cyberlink)
SRV - (AVM IGD CTRL Service) -- C:\Programme\FRITZ!DSL\IGDCTRL.EXE (AVM Berlin)
SRV - (de_serv) -- C:\Programme\Gemeinsame Dateien\AVM\De_serv.exe (AVM Berlin)
SRV - (USBDeviceService) -- C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\USBDeviceService.exe ()
SRV - (UleadBurningHelper) -- C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (AOL ACS) -- C:\Programme\Gemeinsame Dateien\aol\ACS\AOLacsd.exe (America Online, Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (WDICA) --  File not found
DRV - (VcommMgr) -- System32\Drivers\VcommMgr.sys File not found
DRV - (VComm) -- system32\DRIVERS\VComm.sys File not found
DRV - (PDRFRAME) --  File not found
DRV - (PDRELI) --  File not found
DRV - (PDFRAME) --  File not found
DRV - (PDCOMP) --  File not found
DRV - (PCIDump) --  File not found
DRV - (lbrtfdc) --  File not found
DRV - (Changer) --  File not found
DRV - (BTHidMgr) -- System32\Drivers\BTHidMgr.sys File not found
DRV - (BTHidEnum) -- System32\Drivers\vbtenum.sys File not found
DRV - (Btcsrusb) -- System32\Drivers\btcusb.sys File not found
DRV - (BT) -- system32\DRIVERS\btnetdrv.sys File not found
DRV - (BlueletSCOAudio) -- system32\DRIVERS\BlueletSCOAudio.sys File not found
DRV - (BlueletAudio) -- system32\DRIVERS\blueletaudio.sys File not found
DRV - (avgtp) -- C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)
DRV - (ggsemc) -- C:\WINDOWS\system32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) -- C:\WINDOWS\system32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (MBAMProtector) -- C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (53326782) -- C:\WINDOWS\system32\drivers\53326782.sys (Kaspersky Lab ZAO)
DRV - (UsbserFilt) -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys (Nokia)
DRV - (upperdev) -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys (Nokia)
DRV - (nmwcdc) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys (Nokia)
DRV - (nmwcd) -- C:\WINDOWS\system32\drivers\ccdcmb.sys (Nokia)
DRV - (KLIF) -- C:\WINDOWS\system32\drivers\klif.sys (Kaspersky Lab)
DRV - (klim5) -- C:\WINDOWS\system32\drivers\klim5.sys (Kaspersky Lab ZAO)
DRV - (kl2) -- C:\WINDOWS\system32\drivers\kl2.sys (Kaspersky Lab ZAO)
DRV - (kl1) -- C:\WINDOWS\system32\drivers\kl1.sys (Kaspersky Lab ZAO)
DRV - (klmouflt) -- C:\WINDOWS\system32\drivers\klmouflt.sys (Kaspersky Lab)
DRV - (ASCTRM) -- C:\WINDOWS\System32\drivers\asctrm.sys (Windows (R) 2000 DDK provider)
DRV - (RT61) -- C:\WINDOWS\system32\drivers\rt61.sys (Ralink Technology Inc.)
DRV - (IntcAzAudAddService) -- C:\WINDOWS\system32\drivers\RtkHDAud.Sys (Realtek Semiconductor Corp.)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation                          )
DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (Afc) -- C:\WINDOWS\system32\drivers\afc.sys (Arcsoft, Inc.)
DRV - (wanatw) -- C:\WINDOWS\system32\drivers\wanatw4.sys (America Online, Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://de.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.yahoo.com
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7GGLL_de
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = hxxp://isearch.avg.com/search?cid={1133C8B5-374A-46D5-818C-9C90320AF147}&mid=51a9eba4178847d1bae2d158216d7636-3b67f0c4633c85ae23a1bec7618b2a0bdc0a837a&lang=de&ds=tt014&pr=sa&d=2011-12-15 21:28:36&v=14.2.0.1&pid=avg&sg=&sap=dsp&q={searchTerms}
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredimail.com/?search={searchTerms}&loc=search_box_im2_test_v2
IE - HKU\S-1-5-21-941014988-1758456970-593946224-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "AVG Secure Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://de.search.yahoo.com/search?fr=ffsp1&p="
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "AVG Secure Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/firefox?client=firefox-a&rls=com.google:de:official"
FF - prefs.js..extensions.enabledAddons: plugin%40yontoo.com:1.20.00
FF - prefs.js..extensions.enabledAddons: %7Bc2d64ff7-0ab8-4263-89c9-ea3b0f8f050c%7D:4.6.1.01
FF - prefs.js..extensions.enabledAddons: %7BACAA314B-EEBA-48e4-AD47-84E31C44796C%7D:4.2.1.9
FF - prefs.js..extensions.enabledAddons: %7BCAFEEFAC-0016-0000-0033-ABCDEFFEDCBA%7D:6.0.33
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.2
FF - prefs.js..extensions.enabledItems: de-AT@dictionaries.addons.mozilla.org:2.0.2
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "hxxp://isearch.avg.com/search?cid={1133C8B5-374A-46D5-818C-9C90320AF147}&mid=51a9eba4178847d1bae2d158216d7636-3b67f0c4633c85ae23a1bec7618b2a0bdc0a837a&lang=de&ds=tt014&pr=sa&d=2011-12-15 21:28:36&pid=avg&sg=&v=14.0.2.14&sap=ku&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_5_502_149.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Programme\Gemeinsame Dateien\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_39: C:\WINDOWS\system32\npdeployJava1.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@mcafee.com/McAfeeMssPlugin: C:\Programme\McAfee Security Scan\3.0.318\npMcAfeeMss.dll (McAfee, Inc.)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Programme\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Programme\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Programme\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Programme\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
FF - HKLM\Software\MozillaPlugins\@zylom.com/ZylomGamesPlayer: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll (Zylom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Programme\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\BrowserPlusPlugins\690e5102bafbf785b6d176ed59a87eb5\npybrowserplus_2.9.8.dll (Yahoo! Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Programme\Kaspersky Security Suite CBE 12\FFExt\virtualKeyboard@kaspersky.ru [2012.05.31 21:04:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Programme\Kaspersky Security Suite CBE 12\FFExt\linkfilter@kaspersky.ru [2012.05.31 21:04:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\KavAntiBanner@Kaspersky.ru: C:\Programme\Kaspersky Security Suite CBE 12\FFExt\KavAntiBanner@Kaspersky.ru [2012.05.31 21:04:44 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Components: C:\Programme\Mozilla Firefox\components [2013.02.06 13:01:30 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.2\extensions\\Plugins: C:\Programme\Mozilla Firefox\plugins [2013.02.06 13:00:29 | 000,000,000 | ---D | M]
 
[2009.06.06 14:58:17 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Extensions
[2009.06.06 14:58:17 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Extensions\home2@tomtom.com
[2013.02.14 14:06:23 | 000,000,000 | ---D | M] (No name found) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions
[2010.04.29 21:15:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012.10.15 20:11:04 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2012.06.03 11:44:35 | 000,000,000 | ---D | M] (Wincore Mediabar) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions\{c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c}
[2011.12.08 09:54:33 | 000,000,000 | ---D | M] (AVG Security Toolbar) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions\avg@toolbar
[2012.10.13 11:32:08 | 000,000,000 | ---D | M] (German Dictionary, extended for Austria) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions\de-AT@dictionaries.addons.mozilla.org
[2012.02.13 13:54:18 | 000,000,000 | ---D | M] (Yontoo) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions\plugin@yontoo.com
[2012.12.11 19:48:07 | 000,036,098 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.02.14 14:06:23 | 000,817,280 | ---- | M] () (No name found) -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2010.09.06 19:44:52 | 000,002,162 | ---- | M] () -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\searchplugins\MyStart Search.xml
[2012.06.03 11:43:54 | 000,002,513 | ---- | M] () -- C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\searchplugins\Search_Results.xml
[2013.02.06 13:00:11 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.02.06 13:00:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA}
[2013.02.06 13:00:10 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA}
[2013.02.06 13:00:11 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBA}
[2013.02.06 13:00:15 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA}
[2013.02.06 12:59:50 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Programme\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
[2013.02.06 12:59:54 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru
[2013.02.06 13:00:03 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Programme\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\SVEN VöLKL\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\QVF8O2WZ.DEFAULT\EXTENSIONS\{ACAA314B-EEBA-48E4-AD47-84E31C44796C}.XPI
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\SVEN VöLKL\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\QVF8O2WZ.DEFAULT\EXTENSIONS\{C2D64FF7-0AB8-4263-89C9-EA3B0F8F050C}
File not found (No name found) -- C:\DOKUMENTE UND EINSTELLUNGEN\SVEN VöLKL\ANWENDUNGSDATEN\MOZILLA\FIREFOX\PROFILES\QVF8O2WZ.DEFAULT\EXTENSIONS\PLUGIN@YONTOO.COM
[2013.02.06 13:01:27 | 000,262,552 | ---- | M] (Mozilla Foundation) -- C:\Programme\mozilla firefox\components\browsercomps.dll
[2006.07.31 15:07:16 | 000,098,304 | ---- | M] (Zylom) -- C:\Programme\mozilla firefox\plugins\npzylomgamesplayer.dll
[2013.02.06 13:01:04 | 000,001,392 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.02.19 08:46:01 | 000,003,716 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\avg-secure-search.xml
[2013.02.06 13:01:04 | 000,002,465 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\bing.xml
[2013.02.06 13:01:04 | 000,001,153 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\eBay-de.xml
[2013.02.06 13:01:04 | 000,006,805 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.03 11:43:54 | 000,002,513 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\Search_Results.xml
[2013.02.06 13:01:04 | 000,001,178 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.02.06 13:01:04 | 000,001,105 | ---- | M] () -- C:\Programme\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
 
O1 HOSTS File: ([2007.04.04 20:00:19 | 000,000,874 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (MSS+ Identifier) - {0E8A89AD-95D7-40EB-8D9D-083EF7066A01} - C:\Programme\McAfee Security Scan\3.0.318\McAfeeMSS_IE.dll (McAfee, Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Programme\Kaspersky Security Suite CBE 12\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll ()
O2 - BHO: (DataMngr) - {B939CF93-F2CB-443d-956C-DC523D85C9DB} - C:\Programme\BearShare Applications\MediaBar\Datamngr\BrowserConnection.dll (MusicLab, LLC)
O2 - BHO: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Programme\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll ()
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\APPS\BAE\BAE.DLL (Your Company Name)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Programme\Kaspersky Security Suite CBE 12\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programme\Yontoo\YontooIEClient.dll (Yontoo LLC)
O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Programme\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Programme\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll ()
O3 - HKLM\..\Toolbar: (Wincore Mediabar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Programme\BearShare Applications\MediaBar\Datamngr\ToolBar\wincorebsdtx.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.
O3 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\Toolbar\WebBrowser: (no name) - {E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} - No CLSID value found.
O3 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe ARM] C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [AVP] C:\Programme\Kaspersky Security Suite CBE 12\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [AzMixerSel] C:\Programme\Realtek\InstallShield\AzMixerSel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC)
O4 - HKLM..\Run: [DetectorApp] C:\Programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe ()
O4 - HKLM..\Run: [EULA] C:\APPS\PB_TB\EULALauncher.exe (Fujitsu-Siemens)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [ISUSPM Startup] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [ISUSScheduler] C:\Programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
O4 - HKLM..\Run: [PCMService] c:\APPS\Powercinema\PCMService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Programme\Gemeinsame Dateien\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [vProt] C:\Programme\AVG Secure Search\vprot.exe ()
O4 - HKU\S-1-5-21-941014988-1758456970-593946224-1006..\Run: [EPSON SX125 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIGGE.EXE (SEIKO EPSON CORPORATION)
O4 - HKU\S-1-5-21-941014988-1758456970-593946224-1006..\Run: [Messenger (Yahoo!)] C:\Programme\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKU\S-1-5-21-941014988-1758456970-593946224-1006..\Run: [TomTomHOME.exe] C:\Programme\TomTom HOME 2\TomTomHOMERunner.exe (TomTom)
O4 - Startup: C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk = C:\Programme\McAfee Security Scan\3.0.318\SSScheduler.exe (McAfee, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetIcon = 1
O8 - Extra context menu item: &Search - hxxp://speedbar.myway.com/menusearch.html?p=MG2 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Dokumente und Einstellungen\Sven Völkl\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Hinzufügen zu Anti-Banner - C:\Programme\Kaspersky Security Suite CBE 12\ie_banner_deny.htm ()
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 File not found
O9 - Extra Button: &Virtuelle Tastatur - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Programme\Kaspersky Security Suite CBE 12\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Li&nks untersuchen - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Programme\Kaspersky Security Suite CBE 12\klwtbbho.dll (Kaspersky Lab ZAO)
O15 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..Trusted Domains: aol.com ([objects] * is out of zone range -  5)
O15 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKU\S-1-5-21-941014988-1758456970-593946224-1006\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {CAFEEFAC-0015-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_04-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0039-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_39-windows-i586.cab (Java Plug-in 1.6.0_39)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{2FFC8F9A-38AF-406C-A12B-9D68C3589B4F}: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\viprotocol {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Programme\Gemeinsame Dateien\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll ()
O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Programme\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Programme\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - (Ati2evxx.dll) - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\klogon: DllName - (C:\WINDOWS\system32\klogon.dll) - C:\WINDOWS\system32\klogon.dll (Kaspersky Lab ZAO)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Sven Völkl\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Sven Völkl\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (OODBS)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.02.12 21:07:41 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\McAfee Security Scan Plus
[2013.02.06 12:59:33 | 000,000,000 | ---D | C] -- C:\Programme\Mozilla Firefox
[2013.02.04 09:15:12 | 000,158,128 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2013.02.04 09:15:12 | 000,149,936 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2013.02.04 09:15:12 | 000,149,936 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2013.02.01 08:37:05 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Sven Völkl\Eigene Dateien\Bilder für Moni
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.02.19 10:12:17 | 000,000,884 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013.02.19 09:54:11 | 000,001,098 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013.02.19 08:41:03 | 000,033,112 | ---- | M] (AVG Technologies) -- C:\WINDOWS\System32\drivers\avgtpx86.sys
[2013.02.19 08:39:34 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.02.19 08:36:25 | 000,001,094 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013.02.19 08:36:14 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.02.19 08:36:11 | 937,603,072 | -HS- | M] () -- C:\hiberfil.sys
[2013.02.19 08:36:10 | 000,918,687 | ---- | M] () -- C:\WINDOWS\System32\OODBS.lor
[2013.02.17 21:34:59 | 000,000,406 | ---- | M] () -- C:\WINDOWS\tasks\1-Klick-Wartung.job
[2013.02.13 16:46:52 | 000,243,128 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013.02.13 12:31:45 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2013.02.13 12:08:02 | 000,528,210 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013.02.13 12:08:02 | 000,503,180 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013.02.13 12:08:02 | 000,106,126 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013.02.13 12:08:02 | 000,088,704 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013.02.12 21:07:41 | 000,001,736 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk
[2013.02.08 11:13:16 | 000,697,712 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013.02.08 11:13:16 | 000,074,096 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013.01.26 04:55:37 | 000,552,448 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oleaut32.dll
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.02.12 21:07:07 | 000,001,736 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart\McAfee Security Scan Plus.lnk
[2012.09.12 21:26:25 | 000,189,498 | ---- | C] () -- C:\Dokumente und Einstellungen\LocalService\Lokale Einstellungen\Anwendungsdaten\WPFFontCache_v0400-System.dat
[2012.06.03 08:49:30 | 000,002,510 | ---- | C] () -- C:\WINDOWS\System32\ASOROSet.bin
[2012.02.16 14:11:40 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll
[2012.02.13 14:11:55 | 000,017,408 | ---- | C] () -- C:\Dokumente und Einstellungen\Sven Völkl\Lokale Einstellungen\Anwendungsdaten\WebpageIcons.db
[2012.02.13 14:08:33 | 000,116,189 | ---- | C] () -- C:\WINDOWS\System32\drivers\klin.dat
[2012.02.13 14:08:32 | 000,098,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\klick.dat
[2011.12.19 15:13:00 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2011.10.30 09:34:23 | 000,000,021 | ---- | C] () -- C:\WINDOWS\progman.ini
[2011.03.11 11:43:54 | 000,029,763 | ---- | C] () -- C:\WINDOWS\System32\drivers\klopp.dat
[2008.10.30 09:49:34 | 000,000,022 | ---- | C] () -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\8f01a90e-7eb3-48d3-93b1-50d88fd146fb
[2007.02.10 15:34:43 | 000,050,176 | ---- | C] () -- C:\Dokumente und Einstellungen\Sven Völkl\Lokale Einstellungen\Anwendungsdaten\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007.01.25 15:21:39 | 000,002,510 | ---- | C] () -- C:\Dokumente und Einstellungen\Sven Völkl\secedit.INTEG.RAW
[2007.01.25 15:21:39 | 000,000,143 | ---- | C] () -- C:\Dokumente und Einstellungen\Sven Völkl\Lokale Einstellungen\Anwendungsdaten\fusioncache.dat
 
========== ZeroAccess Check ==========
 
[2006.12.18 15:51:46 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2009.03.03 00:10:15 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 11:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 03:22:32 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
--- --- ---
OTL Logfile:
Code:
OTL Extras logfile created on: 19.02.2013 09:10:29 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Dokumente und Einstellungen\Sven Völkl\Eigene Dateien\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
894,10 Mb Total Physical Memory | 317,57 Mb Available Physical Memory | 35,52% Memory free
2,10 Gb Paging File | 1,19 Gb Available in Paging File | 56,69% Paging File free
Paging file location(s): C:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 74,52 Gb Total Space | 32,85 Gb Free Space | 44,08% Space Free | Partition Type: NTFS
 
Computer Name: SN426168555778 | User Name: Sven Völkl | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_USERS\S-1-5-21-941014988-1758456970-593946224-1006\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Programme\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
"DisableMonitoring" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
"DisableMonitoring" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
 
========== System Restore Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Programme\BearShare Applications\BearShare\BearShare.exe" = C:\Programme\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"D:\setup.exe" = D:\setup.exe:*:Enabled:Installationsprogramm für Kaspersky Security Suite CBE
"C:\Programme\BearShare Applications\MediaBar\Datamngr\ToolBar\dtUser.exe" = C:\Programme\BearShare Applications\MediaBar\Datamngr\ToolBar\dtUser.exe:*:Enabled:DTX broker -- (Visicom Media Inc.)
 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00010407-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Professional
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic RecordNow Data
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD LE
"{26A24AE4-039D-4CA4-87B4-2F83216033FF}" = Java(TM) 6 Update 39
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150040}" = J2SE Runtime Environment 5.0 Update 4
"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{4281435C-AD1D-4C8A-B9C0-3961C11EF142}_is1" = YouTube Song Downloader
"{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Security Suite CBE 12
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"{4FE82F4B-B7D8-4E65-84AD-E0436CDE57DD}" = ArcSoft PhotoImpression 5
"{53480370-6CA2-47EC-BC05-02B4B9271C31}" = O&O Defrag Professional Edition
"{5A065EA0-0EEC-4E94-A2A0-40812576C122}" = Ulead PhotoImpact 10 SE
"{5E8A1B08-0FBD-4543-9646-F2C2D0D05750}" = Macromedia Flash Player 8
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{763D6973-2A53-4348-992C-75B69D6B7500}" = GrabCaptureScreen
"{7D1D6A24-65D4-454C-8815-4F08A5FFF12C}" = Macromedia Shockwave Player
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{8EAB2384-C794-40ED-A9DD-3270A0D2BB76}" = Ulead VideoStudio 9.0 SE DVD
"{8F3C31C5-9C3A-4AA8-8EFA-71290A7AD533}" = TomTom HOME Visual Studio Merge Modules
"{9017CEAF-BE5A-4F73-8A0E-C87E26971E55}" = TomTom HOME
"{95140000-00AF-0407-0000-0000000FF1CE}" = Microsoft PowerPoint Viewer
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C450606-ED24-4958-92BA-B8940C99D441}" = PixiePack Codec Pack
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic RecordNow Audio
"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.3 - Deutsch
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic RecordNow Copy
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}" = Nokia Connectivity Cable Driver
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}" = Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU
"{C314CE45-3392-3B73-B4E1-139CD41CA933}" = Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU
"{C833C7B6-1140-471D-932B-391B5CA66D7D}" = Digital Video
"{C8BB4912-12D9-42AE-B571-E580D8CD1B5B}" = TuneUp Utilities 2007
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D67B1C57-0E05-4F8C-9011-1C8BAE293782}" = Samsung PC Studio
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9-Reihe
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E883DCB3-766D-4166-8B28-33C8FE451F2B}" = ArcSoft ShowBiz DVD 2
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AVG Secure Search" = AVG Security Toolbar
"AVMFBox" = AVM FRITZ!Box Dokumentation
"CCleaner" = CCleaner
"EPSON Scanner" = EPSON Scan
"EPSON SX125 Series" = Druckerdeinstallation für EPSON SX125 Series
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.22.508
"FreeRIP_is1" = FreeRIP v2.951
"FRITZ!DSL" = AVM FRITZ!DSL
"Google Desktop" = Google Desktop
"ie8" = Windows Internet Explorer 8
"InstallShield_{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}" = SmartSound Quicktracks Plugin
"InstallWIX_{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Security Suite CBE 12
"KLiteCodecPack_is1" = K-Lite Codec Pack 6.0.4 (Basic)
"LifeGlobe Goldfish Aquarium_is1" = LifeGlobe Goldfish Aquarium
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mozilla Firefox 18.0.2 (x86 de)" = Mozilla Firefox 18.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"QuickTime" = QuickTime
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"VLC media player" = VLC media player 2.0.1
"Wdf01009" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
"Wincore MediaBar" = Wincore MediaBar
"Windows Media Encoder 9" = Windows Media Encoder 9-Reihe
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Software Update" = Yahoo! Software Update
"Zylom Games Player Plugin" = Zylom Games Player Plugin
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-941014988-1758456970-593946224-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"magentic" = Genieo for Magentic
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 18.12.2012 14:13:06 | Computer Name = SN426168555778 | Source = Application Error | ID = 1000
Description = Fehlgeschlagene Anwendung avp.exe, Version 12.0.0.374, fehlgeschlagenes
 Modul avzkrnl.dll, Version 4.35.0.2, Fehleradresse 0x00009319.
 
Error - 20.12.2012 12:53:00 | Computer Name = SN426168555778 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung explorer.exe, Version 6.0.2900.5512, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 09.01.2013 06:35:41 | Computer Name = SN426168555778 | Source = .NET Runtime Optimization Service | ID = 1101
Description = .NET Runtime Optimization Service (clr_optimization_v4.0.30319_32)
 - Failed to compile: c:\Programme\Reference Assemblies\Microsoft\Framework\v3.0\System.IdentityModel.Selectors.dll
 . Error code = 0x80070005 
 
Error - 09.01.2013 07:49:12 | Computer Name = SN426168555778 | Source = .NET Runtime Optimization Service | ID = 1103
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
 - Tried to start a service that wasn't the latest version of CLR Optimization service.
 Will shutdown
 
Error - 19.01.2013 06:09:41 | Computer Name = SN426168555778 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung mbam-setup-1.70.0.1100.tmp, Version 51.52.0.0,
 Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 19.01.2013 06:09:41 | Computer Name = SN426168555778 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung mbam-setup-1.70.0.1100.tmp, Version 51.52.0.0,
 Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 19.01.2013 06:09:41 | Computer Name = SN426168555778 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung mbam-setup-1.70.0.1100.tmp, Version 51.52.0.0,
 Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 19.01.2013 06:09:41 | Computer Name = SN426168555778 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung mbam-setup-1.70.0.1100.tmp, Version 51.52.0.0,
 Stillstandmodul hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 29.01.2013 13:46:02 | Computer Name = SN426168555778 | Source = Application Hang | ID = 1002
Description = Stillstehende Anwendung mbam.exe, Version 1.70.0.9, Stillstandmodul
 hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.
 
Error - 13.02.2013 11:49:31 | Computer Name = SN426168555778 | Source = WmiAdapter | ID = 4099
Description = Dienst konnte nicht geöffnet werden.
 
[ System Events ]
Error - 17.02.2013 14:58:17 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst
 auf Anwendungsebene.
 
Error - 17.02.2013 14:58:18 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1053
 
Error - 18.02.2013 03:42:41 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst
 auf Anwendungsebene.
 
Error - 18.02.2013 03:42:42 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1053
 
Error - 18.02.2013 03:50:45 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst
 auf Anwendungsebene.
 
Error - 18.02.2013 03:50:45 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1053
 
Error - 19.02.2013 03:37:59 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst IMAPI-CD-Brenn-COM-Dienste.
 
Error - 19.02.2013 03:37:59 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "IMAPI-CD-Brenn-COM-Dienste" wurde aufgrund folgenden Fehlers
 nicht gestartet:  %%1053
 
Error - 19.02.2013 03:38:46 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7009
Description = Zeitüberschreitung (30000 ms) beim Verbindungsversuch mit Dienst Gatewaydienst
 auf Anwendungsebene.
 
Error - 19.02.2013 03:38:46 | Computer Name = SN426168555778 | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Gatewaydienst auf Anwendungsebene" wurde aufgrund folgenden
 Fehlers nicht gestartet:  %%1053
 
 
< End of report >
--- --- ---
[code]

cosinus 20.02.2013 13:13
Bitte nun Logs mit GMER (<<< klick für Anleitung) und MBAR (Anleitung etwas weiter unten) erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim zweiten Mal nicht will, lass es einfach weg und führ nur MBAR aus.

Anleitung MBAR:

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

gismo74 20.02.2013 16:46
Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1020
www.malwarebytes.org

Database version: v2013.02.20.04

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
*** :: SN426168555778 [administrator]

20.02.2013 16:36:43
mbar-log-2013-02-20 (16-36-43).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 26172
Time elapsed: 39 minute(s), 30 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
[code]
GMER Logfile:
Code:
GMER 2.1.18952 - hxxp://www.gmer.net
Rootkit scan 2013-02-20 17:17:43
Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST980811A rev.3.ALA 74,53GB
Running: GMER_2.1.18952.exe; Driver: C:\DOKUME~1\SVENVL~1\LOKALE~1\Temp\awroifog.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwAdjustPrivilegesToken [0xED4EDFBA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwClose [0xED4EE8B4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwConnectPort [0xED507AEE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateEvent [0xED4EEE26]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateMutant [0xED4EED14]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreatePort [0xED507E06]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateProcess [0xED4EF056]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateProcessEx [0xED4EF21E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateSection [0xED4EDD76]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateSemaphore [0xED4EEF3E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateSymbolicLinkObject [0xED509110]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateThread [0xED4EE5E6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwCreateWaitablePort [0xED507ECE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwDebugActiveProcess [0xED4EF53C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwDeleteKey [0xED502084]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwDeleteValueKey [0xED50388E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwDeviceIoControlFile [0xED4EE8F6]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwDuplicateObject [0xED4F053C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwEnumerateKey [0xED503088]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwEnumerateValueKey [0xED503A38]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwLoadDriver [0xED4EF62E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwLoadKey [0xED502BC0]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwLoadKey2 [0xED502E1C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwMapViewOfSection [0xED509130]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwNotifyChangeKey [0xED50630A]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwOpenEvent [0xED4EEEB8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwOpenMutant [0xED4EEDA0]
SSDT            \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys                                                                                        ZwOpenProcess [0xB9A5AC4C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwOpenSection [0xED4EF97E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwOpenSemaphore [0xED4EEFD0]
SSDT            \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys                                                                                        ZwOpenThread [0xB9A5AD3C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwPlugPlayControl [0xED509120]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwQueryKey [0xED501EB8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwQueryMultipleValueKey [0xED503698]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwQueryObject [0xED506500]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwQuerySection [0xED4EFEC0]
SSDT            \??\C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)                                                                          ZwQueryValueKey [0xF77631AE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwQueueApcThread [0xED4EF7CE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwRenameKey [0xED502198]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwReplaceKey [0xED50280C]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwReplyPort [0xED508048]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwReplyWaitReceivePort [0xED507F96]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwRequestWaitReplyPort [0xED5080B4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwRestoreKey [0xED502A14]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwResumeThread [0xED4F03DE]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSaveKey [0xED50233E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSaveKeyEx [0xED5024D4]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSaveMergedKeys [0xED502670]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSecureConnectPort [0xED507C76]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSetContextThread [0xED4EE756]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSetInformationToken [0xED4EF3E8]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSetSystemInformation [0xED4F0010]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSetValueKey [0xED503248]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSuspendProcess [0xED4F0104]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSuspendThread [0xED4F023E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwSystemDebugControl [0xED4EF45E]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwTerminateProcess [0xED4EE392]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwTerminateThread [0xED4EE2EA]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwUnmapViewOfSection [0xED4EFD78]
SSDT            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    ZwWriteVirtualMemory [0xED4EE47C]

Code            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    FsRtlCheckLockForReadAccess
Code            \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)                                                    IoIsOperationSynchronous
Code            \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys                                                                                        KeInsertQueueApc

---- Kernel code sections - GMER 2.1 ----

.text          ntoskrnl.exe!_abnormal_termination + B0                                                                                                  804E271C 4 Bytes  [B4, E8, 4E, ED] {MOV AH, 0xe8; DEC ESI; IN EAX, DX}
.text          ntoskrnl.exe!_abnormal_termination + 104                                                                                                  804E2770 12 Bytes  [06, 7E, 50, ED, 56, F0, 4E, ...] {PUSH ES; JLE 0x53; IN EAX, DX; PUSH ESI; DEC ESI; IN EAX, DX; PUSH DS; DEC ESI; IN EAX, DX}
.text          ntoskrnl.exe!_abnormal_termination + 114                                                                                                  804E2780 16 Bytes  [76, DD, 4E, ED, 3E, EF, 4E, ...] {JBE 0xffffffdf; DEC ESI; IN EAX, DX; OUT DX, EAX; DEC ESI; IN EAX, DX; ADC [ECX-0x1a1912b0], DL; DEC ESI; IN EAX, DX}
.text          ntoskrnl.exe!_abnormal_termination + 1D0                                                                                                  804E283C 12 Bytes  [2E, F6, 4E, ED, C0, 2B, 50, ...]
.text          ntoskrnl.exe!_abnormal_termination + 34C                                                                                                  804E29B8 16 Bytes  [98, 21, 50, ED, 0C, 28, 50, ...] {CWDE ; AND [EAX-0x13], EDX; OR AL, 0x28; PUSH EAX; IN EAX, DX; DEC EAX; ADC BYTE [EAX-0x13], 0x96; JG 0x5f; IN EAX, DX}
.text          ...                                                                                                                                     
.text          ntoskrnl.exe!KeInsertQueueApc                                                                                                            804E5421 5 Bytes  JMP B9A5D050 \??\C:\WINDOWS\system32\drivers\mbamchameleon.sys
.text          ntoskrnl.exe!IoIsOperationSynchronous                                                                                                    804E876A 5 Bytes  JMP ED4E0DCC \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)
.text          ntoskrnl.exe!FsRtlCheckLockForReadAccess                                                                                                  805129A1 5 Bytes  JMP ED4E09F0 \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter [fre_wnet_x86]/Kaspersky Lab)

---- User code sections - GMER 2.1 ----

?              C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] C:\WINDOWS\system32\ntdll.dll                                                  time/date stamp mismatch;
.text          C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] ntdll.dll!NtProtectVirtualMemory                                                7C91D6EE 5 Bytes  JMP 6B731765 C:\Programme\Kaspersky Security Suite CBE 12\ushata.dll (Ushata module/Kaspersky Lab ZAO)
?              C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] C:\WINDOWS\system32\kernel32.dll                                                time/date stamp mismatch;
.text          C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] USER32.dll!AlignRects                                                          7E362A78 4 Bytes  [E0, 13, 54, 67]
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[1152] USER32.dll!DefWindowProcA + 11A                                                  7E37C298 7 Bytes  JMP 10831678 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[1152] USER32.dll!SetWindowLongA + 19                                                    7E37C2B6 7 Bytes  JMP 10831607 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[1152] USER32.dll!GetWindowInfo                                                          7E37C49C 5 Bytes  JMP 1045FBF7 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\plugin-container.exe[1152] USER32.dll!GetMenuContextHelpId + 1A                                              7E3B5319 7 Bytes  JMP 10460118 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
?              C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] C:\WINDOWS\system32\ntdll.dll                                                  time/date stamp mismatch;
.text          C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] ntdll.dll!NtProtectVirtualMemory                                              7C91D6EE 5 Bytes  JMP 6B731765 C:\Programme\Kaspersky Security Suite CBE 12\ushata.dll (Ushata module/Kaspersky Lab ZAO)
?              C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] C:\WINDOWS\system32\kernel32.dll                                              time/date stamp mismatch;
.text          C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] USER32.dll!AlignRects                                                          7E362A78 4 Bytes  [E0, 13, 54, 67]
.text          C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe[2060] kernel32.dll!ExitProcess                                                7C81D20A 5 Bytes  JMP 05052422 C:\Programme\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)
.text          C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe[2060] USER32.dll!MessageBoxA                                                  7E3A07EA 5 Bytes  JMP 050523CC C:\Programme\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)
.text          C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe[2060] USER32.dll!MessageBoxW                                                  7E3B6534 5 Bytes  JMP 050523F7 C:\Programme\Google\Google Desktop Search\GoogleServices.DLL (Google Desktop/Google)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] ntdll.dll!NtClose                                                                          7C91CFEE 5 Bytes  JMP 1003CD50 C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll (Data Manager/MusicLab, LLC)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] ntdll.dll!NtCreateFile                                                                    7C91D0AE 5 Bytes  JMP 1003CB90 C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll (Data Manager/MusicLab, LLC)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] ntdll.dll!NtOpenFile                                                                      7C91D59E 5 Bytes  JMP 1003CB10 C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll (Data Manager/MusicLab, LLC)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] ntdll.dll!NtQueryInformationFile                                                          7C91D7CE 5 Bytes  JMP 1003CDC0 C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll (Data Manager/MusicLab, LLC)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] ntdll.dll!NtReadFile                                                                      7C91D9CE 5 Bytes  JMP 1003CC30 C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll (Data Manager/MusicLab, LLC)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] ntdll.dll!NtSetInformationFile                                                            7C91DC5E 5 Bytes  JMP 1003CE40 C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll (Data Manager/MusicLab, LLC)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] ntdll.dll!NtWriteFile                                                                      7C91DF7E 5 Bytes  JMP 1003CCC0 C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll (Data Manager/MusicLab, LLC)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] ntdll.dll!LdrLoadDll                                                                      7C92632D 5 Bytes  JMP 01648BF0 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] kernel32.dll!lstrlenW + 43                                                                7C809AEC 7 Bytes  JMP 01997FF0 C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] kernel32.dll!MapViewOfFileEx + 6A                                                          7C80B9A0 7 Bytes  JMP 01997FCD C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] kernel32.dll!ValidateLocale + B1C8                                                        7C8449C8 7 Bytes  JMP 0165F1AD C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text          C:\Programme\Mozilla Firefox\firefox.exe[2432] GDI32.dll!SetDIBitsToDevice + 20A                                                          77EF9E14 7 Bytes  JMP 01997F4E C:\Programme\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Kernel IAT/EAT - GMER 2.1 ----

IAT            \SystemRoot\system32\DRIVERS\ipsec.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\tcpip.sys[TDI.SYS!TdiRegisterDeviceObject]                                                                  [F70ECE60] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\netbt.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\netbt.sys[TDI.SYS!TdiRegisterDeviceObject]                                                                  [F70ECE60] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\System32\drivers\ws2ifsl.sys[ntoskrnl.exe!IoCreateDevice]                                                                    [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateDevice]                                                                        [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\netbios.sys[ntoskrnl.exe!IoCreateDevice]                                                                    [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\rdbss.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\System32\Drivers\Fips.SYS[ntoskrnl.exe!IoCreateDevice]                                                                        [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\ipnat.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\wanarp.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\System32\Drivers\Cdfs.SYS[ntoskrnl.exe!IoCreateDevice]                                                                        [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\ndisuio.sys[ntoskrnl.exe!IoCreateDevice]                                                                    [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\drivers\wdmaud.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\drivers\sysaudio.sys[ntoskrnl.exe!IoCreateDevice]                                                                    [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateDevice]                                                                        [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\System32\Drivers\HTTP.sys[ntoskrnl.exe!IoCreateDevice]                                                                        [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\DRIVERS\ipfltdrv.sys[ntoskrnl.exe!IoCreateDevice]                                                                    [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
IAT            \SystemRoot\system32\drivers\kmixer.sys[ntoskrnl.exe!IoCreateDevice]                                                                      [F70ECD10] kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

---- User IAT/EAT - GMER 2.1 ----

IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlAllocateHeap]                  7DFF058C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlFreeHeap]                      7DFF05F8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlSizeHeap]                      7DFF0664
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlReAllocateHeap]                7DFF06D0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlAllocateHeap]                  7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlReAllocateHeap]                7DFF0370
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateThread]                    7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetModuleHandleW]                7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlFreeHeap]                        7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlAllocateHeap]                    7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlAllocateHeap]                  7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetErrorMode]                    7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetModuleHandleA]                7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapDestroy]                    7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapCreate]                      7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!CreateThread]                    7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlAllocateHeap]                  7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleW]                7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!CreateThread]                    7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleA]                7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlAllocateHeap]                    7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlFreeHeap]                        7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]      7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!FreeLibrary]                      7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlAllocateHeap]                    7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlFreeHeap]                        7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapCreate]                      7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapDestroy]                    7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!CreateThread]                    7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapDestroy]                    7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapCreate]                    7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapCreate]                    7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapDestroy]                    7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\SHELL32.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!FreeLibrary]                      7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter]      7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetModuleHandleW]                7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FreeLibrary]                      7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread]                    7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]      7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\ole32.dll [ntdll.dll!RtlFreeHeap]                        7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\userenv.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[732] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW]                          [614AAE77] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA]                            [614AADA9] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                          [614AA7A3] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW]                            [614AADE9] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\USER32.dll [GDI32.dll!GetStockObject]                            [614A9CEC] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW]                        [614AAE77] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryA]                          [614AADA9] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                        [614AA7A3] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryW]                          [614AADE9] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [GDI32.dll!GetStockObject]                          [614A9CEC] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA]                        [614AAE29] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW]                        [614AAE77] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW]                          [614AADE9] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA]                          [614AADA9] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                        [614AA7A3] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcA]                          [614AA3BA] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!DefWindowProcW]                          [614AA3BA] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!GetSysColor]                            [614A9C27] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenu]                          [614A9B56] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHLWAPI.dll [USER32.dll!TrackPopupMenuEx]                        [614A9B94] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [GDI32.dll!GetStockObject]                          [614A9CEC] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA]                          [614AADA9] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW]                          [614AADE9] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]                        [614AA7A3] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW]                        [614AAE77] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExA]                        [614AAE29] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!AnimateWindow]                          [614A9D87] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TrackPopupMenuEx]                        [614A9B94] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcA]                          [614AA3BA] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColor]                            [614A9C27] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!DefWindowProcW]                          [614AA3BA] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!GetSysColorBrush]                        [614A9CF2] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Yahoo!\Messenger\ymsgr_tray.exe[1212] @ C:\WINDOWS\system32\SHELL32.dll [USER32.dll!TrackPopupMenu]                          [614A9B56] C:\Programme\Yahoo!\Messenger\yui.dll
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlAllocateHeap]                7DFF058C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlFreeHeap]                    7DFF05F8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlSizeHeap]                    7DFF0664
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!RtlReAllocateHeap]              7DFF06D0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetErrorMode]                7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!CreateThread]                7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleW]            7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetModuleHandleA]            7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]              7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlFreeHeap]                    7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlAllocateHeap]                7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ADVAPI32.dll [ntdll.dll!RtlReAllocateHeap]              7DFF0370
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\RPCRT4.dll [ntdll.dll!RtlAllocateHeap]                  7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\Secur32.dll [ntdll.dll!RtlAllocateHeap]                  7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapDestroy]                    7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!HeapCreate]                    7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress]              7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!CreateThread]                7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlAllocateHeap]                7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\NETAPI32.dll [ntdll.dll!RtlFreeHeap]                    7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlAllocateHeap]                  7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\USER32.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlAllocateHeap]                    7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\GDI32.dll [ntdll.dll!RtlFreeHeap]                        7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapCreate]                    7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!HeapDestroy]                    7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapDestroy]                  7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!HeapCreate]                    7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapCreate]                    7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!HeapDestroy]                  7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SHELL32.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\userenv.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\userenv.dll [ntdll.dll!RtlFreeHeap]                      7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress]                  7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetModuleHandleW]                7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!FreeLibrary]                    7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread]                    7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\ole32.dll [ntdll.dll!RtlFreeHeap]                        7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!HeapCreate]                  7DFF04B4
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!HeapDestroy]                  7DFF0520
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress]              7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\iphlpapi.dll [ntdll.dll!RtlFreeHeap]                    7DFF0304
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\iphlpapi.dll [ntdll.dll!RtlAllocateHeap]                7DFF0298
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!CreateThread]                  7DFF0448
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!SetErrorMode]                  7DFF0D90
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetModuleHandleA]              7DFF0C4C
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetModuleHandleW]              7DFF0CB8
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!SetUnhandledExceptionFilter]  7DFF0DFC
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!GetProcAddress]                7DFF0D24
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\wininet.dll [KERNEL32.dll!FreeLibrary]                  7DFF0BE0
IAT            C:\Programme\Kaspersky Security Suite CBE 12\avp.exe[1228] @ C:\WINDOWS\system32\SAMLIB.dll [KERNEL32.dll!SetUnhandledExceptionFilter]    7DFF0DFC

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                                  kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                                  SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                                                  SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                                kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                              kl1.sys (Kaspersky Unified Driver/Kaspersky Lab ZAO)

Device          \Driver\atapi -> DriverStartIo \Device\Dev_ffffffff85bc7d98                                                                              836F9864
Device          \Driver\atapi \Device\Dev_ffffffff85bc7d98                                                                                                836FC6F2
Device          \Driver\atapi \Device\Dev_ffffffff85bc7d98                                                                                                83703336

---- Registry - GMER 2.1 ----

Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System                                                                                   
Reg            HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG08.00.00.01WORKSTATION                                                      (null)

---- EOF - GMER 2.1 ----
--- --- ---


.. kann ich die Programme auch wieder löschen,oder benötige ich die noch?

cosinus 20.02.2013 21:05
Nun warte doch bitte erstmal ab, wir sind hier noch nicht durch!

aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).




TDSS-Killer

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

gismo74 23.02.2013 20:37
Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-02-23 19:36:34
-----------------------------
19:36:34.671    OS Version: Windows 5.1.2600 Service Pack 3
19:36:34.671    Number of processors: 1 586 0xE08
19:36:34.671    ComputerName: SN426168555778  UserName: Sven Völkl
19:36:46.828    Initialze error C000010E - driver not loaded
19:36:46.890    write error "aswCmnB.dll". Der Prozess kann nicht auf die Datei zugreifen, da sie von einem anderen Prozess verwendet wird.
19:58:26.593    AVAST engine defs: 13022300
19:58:45.578    Service scanning
19:59:16.921    Service kl1 C:\WINDOWS\system32\DRIVERS\kl1.sys **LOCKED** 5
19:59:17.078    Service kl2 C:\WINDOWS\system32\DRIVERS\kl2.sys **LOCKED** 5
19:59:18.015    Service klim5 C:\WINDOWS\system32\DRIVERS\klim5.sys **LOCKED** 5
19:59:18.328    Service klmouflt C:\WINDOWS\system32\DRIVERS\klmouflt.sys **LOCKED** 5
19:59:50.140    Modules scanning
19:59:50.140    Disk 0 trace - called modules:
19:59:50.140   
19:59:57.171    AVAST engine scan C:\WINDOWS
20:00:49.859    AVAST engine scan C:\WINDOWS\system32
20:08:34.515    AVAST engine scan C:\WINDOWS\system32\drivers
20:09:33.968    AVAST engine scan C:\Dokumente und Einstellungen\Sven Völkl
20:20:47.656    AVAST engine scan C:\Dokumente und Einstellungen\All Users
20:27:14.812    Scan finished successfully
20:34:03.250    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Sven Völkl\Desktop\aswMBR.txt"

cosinus 24.02.2013 21:54
Irgendwas ging da schief, aswMBR bitte nochmal machen

gismo74 25.02.2013 11:36
Ich hab da noch ein Problem .. ich wollte von TDSSKiller es auch hier rein tun,dann kam die Meldung das ich es ins Archiv tun soll .. ich hab nur keine Ahnung wie ich das machen soll :confused:


Code:
aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-02-25 09:03:05
-----------------------------
09:03:05.078    OS Version: Windows 5.1.2600 Service Pack 3
09:03:05.078    Number of processors: 1 586 0xE08
09:03:05.109    ComputerName: SN426168555778  UserName: Sven Völkl
09:03:07.953    Initialize success
09:24:04.206    AVAST engine defs: 13022401
09:29:57.722    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
09:29:57.737    Disk 0 Vendor: ST980811A 3.ALA Size: 76319MB BusType: 3
09:29:57.768    Disk 0 MBR read successfully
09:29:57.768    Disk 0 MBR scan
09:29:59.456    Disk 0 Windows XP default MBR code
09:29:59.472    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        76308 MB offset 63
09:30:01.253    Disk 0 scanning sectors +156280320
09:30:02.065    Disk 0 scanning C:\WINDOWS\system32\drivers
09:30:53.315    Service scanning
09:31:10.503    Service kl1 C:\WINDOWS\system32\DRIVERS\kl1.sys **LOCKED** 5
09:31:10.550    Service kl2 C:\WINDOWS\system32\DRIVERS\kl2.sys **LOCKED** 5
09:31:10.768    Service klim5 C:\WINDOWS\system32\DRIVERS\klim5.sys **LOCKED** 5
09:31:10.909    Service klmouflt C:\WINDOWS\system32\DRIVERS\klmouflt.sys **LOCKED** 5
09:31:31.472    Modules scanning
09:31:41.737    Disk 0 trace - called modules:
09:31:41.768    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
09:31:41.768    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b61ab8]
09:31:41.784    3 CLASSPNP.SYS[f76c2fd7] -> nt!IofCallDriver -> \Device\00000091[0x85bc79e8]
09:31:41.784    5 ACPI.sys[f75b8620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x85bc7d98]
09:31:42.456    AVAST engine scan C:\WINDOWS
09:31:56.722    AVAST engine scan C:\WINDOWS\system32
09:39:34.018    AVAST engine scan C:\WINDOWS\system32\drivers
09:40:29.565    AVAST engine scan C:\Dokumente und Einstellungen\Sven Völkl
10:05:08.690    AVAST engine scan C:\Dokumente und Einstellungen\All Users
10:21:32.472    Scan finished successfully
11:01:55.081    Disk 0 MBR has been saved successfully to "C:\Dokumente und Einstellungen\Sven Völkl\Desktop\MBR.dat"
11:01:55.143    The log file has been saved successfully to "C:\Dokumente und Einstellungen\Sven Völkl\Desktop\aswMBR.txt"

cosinus 25.02.2013 13:27
http://www.trojaner-board.de/69886-a...tml#post566999

gismo74 25.02.2013 18:16
Ist mal ein versuch mit dem Anhang ..

cosinus 26.02.2013 00:22
Dann bitte jetzt CF ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Combofix wird überprüfen, ob die Microsoft Windows Wiederherstellungskonsole installiert ist.
    Ist diese nicht installiert, erlaube Combofix diese herunter zu laden und zu installieren. Folge dazu einfach den Anweisungen und aktzeptiere die Endbenutzer-Lizenz.
    Bei heutiger Malware ist dies sehr empfehlenswert, da diese uns eine Möglichkeit bietet, dein System zu reparieren, falls etwas schief geht.
    Bestätige die Information, dass die Wiederherstellungskonsole installiert wurde mit Ja.
    Hinweis: Ist diese bereits installiert, wird Combofix mit der Malwareentfernung fortfahren.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es eine Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

gismo74 26.02.2013 11:00
[code]
Combofix Logfile:
Code:
ComboFix 13-02-24.01 - Sven Völkl 26.02.2013  10:22:51.1.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.49.1031.18.894.356 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Sven Völkl\Desktop\ComboFix.exe
AV: Kaspersky Security Suite CBE *Disabled/Updated* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Kaspersky Security Suite CBE *Disabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\All Users\Anwendungsdaten\8f01a90e-7eb3-48d3-93b1-50d88fd146fb
c:\programme\FunWebProducts
c:\programme\FunWebProducts\MyWay\Cache\CursorManiaBtn.html
c:\programme\FunWebProducts\MyWay\Cache\SmileyCentralBtn.html
c:\programme\MyWay
c:\programme\MyWay\myBar\1.bin\MWHTMLMU.DLL
c:\programme\MyWay\myBar\1.bin\MYPOPSWT.DLL
c:\programme\MyWay\myBar\1.bin\MYWAYPLUGINPROXY.CLASS
c:\programme\MyWay\myBar\1.bin\PARTNER.DAT
c:\programme\MyWay\myBar\1.bin\PARTNER2.DAT
c:\programme\MyWay\myBar\Cache\00020F86
c:\programme\MyWay\myBar\Cache\00021B4E.bin
c:\programme\MyWay\myBar\Cache\00021ED8.bin
c:\programme\MyWay\myBar\Cache\00022214.bin
c:\programme\MyWay\myBar\Cache\00022437.bin
c:\programme\MyWay\myBar\Cache\00022745.bin
c:\programme\MyWay\myBar\Cache\00022A13.bin
c:\programme\MyWay\myBar\Cache\00022BD8.bin
c:\programme\MyWay\myBar\Cache\files.ini
c:\programme\MyWay\myBar\History\search
c:\programme\MyWay\myBar\Settings\prevcfg.htm
c:\programme\MyWay\SrchAstt\1.bin\PARTNER.DAT
c:\programme\MyWay\SrchAstt\Cache\002B6C55
c:\programme\MyWay\SrchAstt\Cache\files.ini
c:\programme\MyWay\SrchAstt\Settings\prevcfg.htm
c:\windows\IsUn0407.exe
c:\windows\system32\Cache
c:\windows\system32\roboot.exe
c:\windows\system32\SET7B.tmp
c:\windows\system32\SET87.tmp
c:\windows\system32\SETCA.tmp
c:\windows\system32\SETCF.tmp
c:\windows\system32\Thumbs.db
c:\windows\system32\URTTemp
c:\windows\system32\URTTemp\fusion.dll
c:\windows\system32\URTTemp\mscoree.dll
c:\windows\system32\URTTemp\mscoree.dll.local
c:\windows\system32\URTTemp\mscorsn.dll
c:\windows\system32\URTTemp\mscorwks.dll
c:\windows\system32\URTTemp\msvcr71.dll
c:\windows\system32\URTTemp\regtlib.exe
c:\windows\wininit.ini
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-01-26 bis 2013-02-26  ))))))))))))))))))))))))))))))
.
.
2013-02-24 11:28 . 2013-02-24 11:28        --------        d-----w-        c:\dokumente und einstellungen\Sven Völkl\Lokale Einstellungen\Anwendungsdaten\Sun
2013-02-22 10:34 . 2013-02-22 10:32        143872        ----a-w-        c:\windows\system32\javacpl.cpl
2013-02-22 10:33 . 2013-02-22 10:32        94112        ----a-w-        c:\windows\system32\WindowsAccessBridge.dll
2013-02-15 18:58 . 2013-02-15 18:58        106088        ----a-w-        c:\programme\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-02-22 10:32 . 2012-06-20 08:23        861088        ----a-w-        c:\windows\system32\npdeployJava1.dll
2013-02-22 10:32 . 2010-04-29 20:19        782240        ----a-w-        c:\windows\system32\deployJava1.dll
2013-02-19 07:41 . 2012-09-04 05:21        33112        ----a-w-        c:\windows\system32\drivers\avgtpx86.sys
2013-02-08 10:13 . 2012-03-31 13:45        697712        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2013-02-08 10:13 . 2011-05-20 21:54        74096        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2013-01-26 03:55 . 2004-08-11 17:47        552448        ----a-w-        c:\windows\system32\oleaut32.dll
2013-01-07 07:24 . 2004-08-11 17:47        2195328        ----a-w-        c:\windows\system32\ntoskrnl.exe
2013-01-07 07:24 . 2004-08-03 23:50        2072064        ----a-w-        c:\windows\system32\ntkrnlpa.exe
2013-01-04 10:09 . 2004-08-11 17:47        1867392        ----a-w-        c:\windows\system32\win32k.sys
2013-01-02 06:49 . 2004-08-11 17:47        1297920        ----a-w-        c:\windows\system32\quartz.dll
2013-01-02 06:49 . 2004-08-11 17:47        148992        ----a-w-        c:\windows\system32\mpg2splt.ax
2012-12-26 20:06 . 2004-08-11 17:48        916480        ----a-w-        c:\windows\system32\wininet.dll
2012-12-26 20:06 . 2004-08-11 17:47        43520        ----a-w-        c:\windows\system32\licmgr10.dll
2012-12-26 20:06 . 2004-08-11 17:47        1469440        ----a-w-        c:\windows\system32\inetcpl.cpl
2012-12-24 06:40 . 2004-08-11 17:47        385024        ----a-w-        c:\windows\system32\html.iec
2012-12-18 17:37 . 2012-12-18 17:37        25200        ----a-w-        c:\windows\system32\drivers\ggsemc.sys
2012-12-18 17:37 . 2012-12-18 17:37        12400        ----a-w-        c:\windows\system32\drivers\ggflt.sys
2012-12-16 12:23 . 2004-08-11 17:47        290560        ----a-w-        c:\windows\system32\atmfd.dll
2012-12-14 15:49 . 2013-01-19 09:57        21104        ----a-w-        c:\windows\system32\drivers\mbam.sys
2013-02-19 20:31 . 2013-02-19 20:30        263064        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
2008-09-29 20:05 . 2013-02-19 20:30        122880        ----a-w-        c:\programme\mozilla firefox\components\GoogleDesktopMozilla.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\~\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233}]
2013-02-19 07:41        1929392        ----a-w-        c:\programme\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{95B7759C-8C7F-4BF1-B163-73684A933233}"= "c:\programme\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll" [2013-02-19 1929392]
.
[HKEY_CLASSES_ROOT\clsid\{95b7759c-8c7f-4bf1-b163-73684a933233}]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj.1]
[HKEY_CLASSES_ROOT\AVG Secure Search.PugiObj]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TomTomHOME.exe"="c:\programme\TomTom HOME 2\TomTomHOMERunner.exe" [2012-07-26 247768]
"Messenger (Yahoo!)"="c:\programme\Yahoo!\Messenger\YahooMessenger.exe" [2010-06-01 5252408]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"SynTPEnh"="c:\programme\Synaptics\SynTP\SynTPEnh.exe" [2006-04-28 766041]
"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]
"AzMixerSel"="c:\programme\Realtek\InstallShield\AzMixerSel.exe" [2005-06-11 53248]
"DetectorApp"="c:\programme\Sonic\DigitalMedia LE v7\MyDVD LE\DetectorApp.exe" [2005-10-20 102400]
"ISUSPM Startup"="c:\progra~1\GEMEIN~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\programme\Gemeinsame Dateien\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"PCMService"="c:\apps\Powercinema\PCMService.exe" [2006-10-12 147456]
"Google Desktop Search"="c:\programme\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-29 29744]
"EULA"="c:\apps\PB_TB\EULALauncher.exe" [2006-10-26 18944]
"vProt"="c:\programme\AVG Secure Search\vprot.exe" [2013-02-19 1151152]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"AVP"="c:\programme\Kaspersky Security Suite CBE 12\avp.exe" [2012-04-10 202296]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2012-07-03 252848]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\
McAfee Security Scan Plus.lnk - c:\programme\McAfee Security Scan\3.0.318\SSScheduler.exe [2013-2-5 272248]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute        REG_MULTI_SZ          autocheck autochk *\0OODBS
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
2006-07-21 14:56        16261632        ----a-w-        c:\windows\RTHDCPL.exe
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SmpcSys"=c:\apps\SMP\SmpSys.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\programme\QuickTime\qttask.exe" -atboottime
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Programme\\BearShare Applications\\MediaBar\\Datamngr\\ToolBar\\dtUser.exe"=
.
R0 53326782;53326782;c:\windows\system32\drivers\53326782.sys [14.03.2012 18:37 133208]
R1 avgtp;avgtp;c:\windows\system32\drivers\avgtpx86.sys [04.09.2012 06:21 33112]
R1 kl2;kl2;c:\windows\system32\drivers\kl2.sys [04.03.2011 12:23 11352]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [10.03.2011 18:34 34608]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [19.01.2013 10:57 21104]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [18.12.2012 18:37 12400]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\drivers\klmouflt.sys [02.11.2009 20:27 19472]
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9C450606-ED24-4958-92BA-B8940C99D441}]
2009-03-04 14:32        8192        ----a-w-        c:\programme\PixiePack Codec Pack\InstallerHelper.exe
.
Inhalt des "geplante Tasks" Ordners
.
2013-02-25 c:\windows\Tasks\1-Klick-Wartung.job
- c:\programme\TuneUp Utilities 2007\SystemOptimizer.exe [2006-11-23 15:46]
.
2013-02-26 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-31 10:13]
.
2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-01-06 22:05]
.
2013-02-26 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2011-01-06 22:05]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://de.yahoo.com
mStart Page = hxxp://de.yahoo.com
uInternet Connection Wizard,ShellNext = hxxp://format.packardbell.com/cgi-bin/redirect/?country=DE&range=AD&phase=8&key=IESTART
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Free YouTube to MP3 Converter - c:\dokumente und einstellungen\Sven Völkl\Anwendungsdaten\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Hinzufügen zu Anti-Banner - c:\programme\Kaspersky Security Suite CBE 12\ie_banner_deny.htm
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.178.1
Handler: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - c:\programme\Gemeinsame Dateien\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
FF - ProfilePath - c:\dokumente und einstellungen\Sven Völkl\Anwendungsdaten\Mozilla\Firefox\Profiles\qvf8o2wz.default\
FF - prefs.js: browser.search.defaulturl - hxxp://de.search.yahoo.com/search?fr=ffsp1&p=
FF - prefs.js: browser.search.selectedEngine - AVG Secure Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/firefox?client=firefox-a&rls=com.google:de:official
FF - prefs.js: keyword.URL - hxxp://isearch.avg.com/search?cid={1133C8B5-374A-46D5-818C-9C90320AF147}&mid=51a9eba4178847d1bae2d158216d7636-3b67f0c4633c85ae23a1bec7618b2a0bdc0a837a&lang=de&ds=tt014&pr=sa&d=2011-12-15 21:28&pid=avg&sg=&v=14.0.2.14&sap=ku&q=
FF - ExtSQL: !HIDDEN! 2009-06-23 23:41; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - ExtSQL: !HIDDEN! 2012-05-31 22:04; linkfilter@kaspersky.ru; c:\programme\Kaspersky Security Suite CBE 12\FFExt\linkfilter@kaspersky.ru
FF - ExtSQL: !HIDDEN! 2012-06-03 12:45; {1FD91A9C-410C-4090-BBCC-55D3450EF433}; c:\programme\BearShare Applications\MediaBar\Datamngr\FirefoxExtension
FF - user.js: network.http.max-persistent-connections-per-server - 2
FF - user.js: nglayout.initialpaint.delay - 100
FF - user.js: content.notify.interval - 750000
FF - user.js: content.max.tokenizing.time - 1500000
FF - user.js: content.switch.threshold - 750000
FF - user.js: extentions.y2layers.installId - 7aad3887-804d-4429-90fe-579c9a42c2a2
FF - user.js: extentions.y2layers.defaultEnableAppsList - TwitTube,toprelatedtopics,dropdowndeals,ezlooker,bestvideodownloader,contenko
FF - user.js: extensions.autoDisableScopes - 14
FF - user.js: security.csp.enable - false
FF - user.js: network.http.max-connections-per-server - 4
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-10 - (no file)
AddRemove-FRITZ!DSL - c:\windows\IsUn0407.exe
AddRemove-LifeGlobe Goldfish Aquarium_is1 - c:\programme\Prolific Publishing
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
AddRemove-magentic - c:\dokumente und einstellungen\Sven Völkl\Anwendungsdaten\Genieo\Application\Partner\uninstall\magentic\partner_uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2013-02-26 10:43
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil32_11_5_502_149_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="92AE165B532492322856363B5584595E9564EC515EA2FB78B9AA77C5CD5695E3E5B23A5A0AF48F9688C0C3EC70F932836720D3CBD90239D9EA46FEDEAC10738CF8425A9600A784B1DD7EBC324BB42330C5508A552DC6713A4BD817ECB915631A8F330FE0E0D93A4FE4FAFB1ADC7802FA0615CC5937FA2E1DE9567C58DBD3BF9E91F1B73EBBFCF9AE7DB620E77A5B2AF2A2A49C7738787C7F764C31BCDE8D64A288FC7569845893062C458E116347FB99B7483B82D66F6DCC48D6796CED54B49F2267AF4E9204D8FA18CF6BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667C038D530D6EB3452A6A0AC4980AC79338EDD5E5BE2F6E6676C9B40328BBC533EB39F5DA6EE78952828CEAFE8E9698EF81A87455E31646E16FA02234E4E0C8D355B7B60257EB8B19DAADF8BB1DF749B734912E57EE884649B733B68B93D07B4236EADA02A411B40C113D955350D19176B204F02F8A66149E7DCCB9DEC8CB3D20590E4B09D171E5FD645B5C47020705801DC9E97FA014C479B749F22E762BD889E1C3676F0D26644DB564DE462B7B6C697F2C57433883B1D1DAA05ACA9DAF108749E962C15BE3B371C1363938EEACD60D8896EBD583E489C95A42DC4B903C498525AE2DE009388141F781B847DC2B937AEFDA66A2198B1ABF03BAE4722DF4C15C443D96F2F05DD4CB63A7E3D39BBA46E4B5FDE464C81D845617805656EE844EE1F04A0969DB47062F4BC771953C5D942216FEC7018564477DA9F0E2331060CA6F7F93CDA513B9670301CD8475D474BFCE9A7895E4B691DE397A30CDA0299A455A7B61A1CCD254DA105A755CA70190E02A032D2D62E81B1C0142EA537F675B6A54E7F870A217134B552DF07F9A808594686EF4A750CD7745A921A65BA315F0CD74C4EB92D57951003BA7CE77EA4D48C511F72D4AA379A7A8C9679B9B94F1494BC49CFC75D83F747EF26E7DAD90735A743B2033CB9036C7DCA6A11745C79C262BEAD66ACC83DF5E6793E4123DB7AD0CD4B4D1D2E3A49E25C9B9B58CB9FD78C2DD6A9A7C6F11F5F1DAFF3D9692DA7474AAFBEEF3B99658718197AFB5BD5180ACD95AE5B5B2EC677403678383948C0A609491CDDD8153959D7F09C5C2021ECC5C59D7202912757F6C5C74598847A77761B853C00E1C129C964655A8F7E7C8B3F37A56F4AF3D9770ACBAD94E61E6883AD35E4BC2191081DBEAB4DD1DB3A322DE8687AE21C7219D2CF914A64493F09A1BB307EFC408B2282133F1363BE0066102A44F9D00FE00B165DF911791284A5917F09F92113D3A1491456B4B4E95D8BF4DC5B98FC7175A8753A0E0AD9CE6DDC164EE01511FD54E8E6834AC4AF3F43EBA252DDDCF3454CBF2761F852D13D60A37671FC207A1FD83053179868005A0BA262CB"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(1108)
c:\windows\SYSTEM32\Ati2evxx.dll
.
Zeit der Fertigstellung: 2013-02-26  10:49:04
ComboFix-quarantined-files.txt  2013-02-26 09:48
.
Vor Suchlauf: 12 Verzeichnis(se), 33.062.039.552 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 35.906.744.320 Bytes frei
.
- - End Of File - - 8AD84C5C028C0DA3A252E923AD698C16
--- --- ---


Ich hab da noch ne Frage .. seit ich die Anweissungen hier mache, läuft mein Labtop immer langsamer .. es dauert ne ewigkeit bis sich ein Fenster öffnet,bzw. tut sich garnix mehr .. mache ich was falsch, oder woran liegen das? ..


Alle Zeitangaben in WEZ +1. Es ist jetzt 22:21 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2026, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132